# Arbitrary file read via ffmpeg HLS parser at https://www.flickr.com/photos/upload

Flickr's ffmpeg-based video preview pipeline accepted HLS playlists referencing local files, letting an uploaded video leak /etc/passwd contents into the cameraroll.

- Payout: hidden
- Severity: critical
- Program: Flickr
- Found by: asad0x01_
- Disclosed: 2020-01-25
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/487008
- Library page: https://bugbountylibrary.com/r/h1%3A487008
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:critical tech:linux vuln:path-traversal vuln:ssrf

**Target:** Video upload/preview conversion (ffmpeg HLS parser)
**Root cause:** ffmpeg's HLS demuxer follows playlist entries that reference local file paths, and Flickr's upload pipeline passed user-supplied media to ffmpeg without restricting external/local references.
**Steps:**
1. Craft an HLS playlist/video file whose segment references a local path such as `/etc/passwd`.
2. Upload it at `https://www.flickr.com/photos/upload/`.
3. Visit `https://www.flickr.com/cameraroll` (or Photostream) and view the generated preview video, which renders the file contents.
**How found:** Reporter knew ffmpeg's HLS parser resolves external references and tested whether Flickr's upload/preview pipeline passed user media to ffmpeg unsandboxed.
**Exploitation:** Attacker uploads a malicious HLS playlist as a video; Flickr's ffmpeg preview generation reads the referenced local file and embeds its contents into the resulting preview, which the attacker views in cameraroll/photostream.
**Escalation:** Report notes potential escalation to SSRF via ffmpeg protocol handling (per referenced BlackHat talk), untested by reporter.
**Insight:** Any service that transcodes user uploads with ffmpeg is a target: submit an HLS/m3u8 (or concat/other demuxer) playlist referencing local paths or URLs and check whether the generated preview reflects file contents or triggers outbound requests.